Hardware Support to Improve Fuzzing Performance and Precision
Hardware Support to Improve Fuzzing Performance and Precision
复制标题
DOI：
10.1145/3460120.3484573
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Ren Ding;Yonghae Kim;F. Sang;Wen Xu;Gururaj Saileshwar;Taesoo Kim
中科院分区：
文献类型：
--
作者：
Ren Ding;Yonghae Kim;F. Sang;Wen Xu;Gururaj Saileshwar;Taesoo Kim
覆盖率引导模糊被认为是最有效的bug查找技术之一，因为它报告了大量的bug。然而，现有的基于软件的方法，如源插装和动态二进制翻译提供的覆盖跟踪，可能会产生很大的开销。由于执行速度显著降低，通过合并额外的执行状态来改善覆盖反馈也变得不那么有益。在本文中，我们提出了SNAP，一个定制的硬件平台，实现硬件原语，以提高覆盖引导模糊的性能和精度。通过位于计算机堆栈的底部，SNAP利用现有的CPU管道和微架构功能，以接近零的成本提供覆盖跟踪和丰富的执行语义，而无论源代码的可用性如何。SNAP原型为FPGA上的合成RISC-V BOOM处理器，在SPEC基准测试中仅产生3.1%的跟踪开销，同时实现了比现有基于软件的解决方案高228倍的模糊吞吐量。SNAP仅占4.8%的面积和6.5%的功耗，非常实用，可以通过现有的CPU架构进行最小的更改。
Coverage-guided fuzzing is considered one of the most efficient bug-finding techniques, given its number of bugs reported. However, coverage tracing provided by existing software-based approaches, such as source instrumentation and dynamic binary translation, can incur large overhead. Hindered by the significantly lowered execution speed, it also becomes less beneficial to improve coverage feedback by incorporating additional execution states. In this paper, we propose SNAP, a customized hardware platform that implements hardware primitives to enhance the performance and precision of coverage-guided fuzzing. By sitting at the bottom of the computer stack, SNAP leverages the existing CPU pipeline and micro-architectural features to provide coverage tracing and rich execution semantics with near-zero cost regardless of source code availability. Prototyped as a synthesized RISC-V BOOM processor on FPGA, SNAP incurs a barely 3.1% tracing overhead on the SPEC benchmarks while achieving a 228x higher fuzzing throughput than the existing software-based solution. Posing only a 4.8% area and 6.5% power overhead, SNAP is highly practical and can be adopted by existing CPU architectures with minimal changes.